The invention relates generally to computer viruses, and more particularly to a technique to detect computer viruses that replicate through electronic mail.
As computer systems and networks have become an integral part of today""s world, some individuals have developed computer viruses which may hinder the operation of computers. Whether a virus is intended simply as a practical joke or a planned attack on a computer network, vast amounts of damage may result. A computer virus is a program that disrupts operations of a computer by modifying (infecting) other executable programs. A virus may also delete or corrupt crucial system files, user data files or application programs. Additionally, computer viruses may make copies of themselves to distribute to other computers connected to a communications network, thereby causing damage to computers at several locations. Computer viruses are usually designed to be hidden from a computer user by being stored at an unusual location on a hard disk, for example.
One way in which computer viruses may be spread is through electronic mail, or e-mail, as it is commonly called. An electronic mail system provides a way for computer users to communicate by sending e-mail messages over a communications network such as a local area network, wide area network, or the Internet. A recent wave of viruses have utilized e-mail technology to spread very quickly and infect computers in various geographic locations. For example, a virus may attempt to send a copy of itself to other computers by sending e-mail messages including destructive code segments.
Various software applications are available which attempt to detect and remove viruses located on a particular computer. These anti-virus applications generally scan computer storage devices searching for bit patterns or code patterns that are commonly used in viruses. Some programs, called integrity checkers, attempt to determine when other executable programs on a computer have been modified. Another technique that may be employed to detect viruses tracks the behavior of executable programs on a computer system. If a program exhibits behavior that is either inconsistent with typical programs or consistent with viruses, the program is flagged. Once suspicious programs have been identified, code segments within the programs may be analyzed to determine if they are performing destructive operations. Conventional anti-virus applications have not been successful in eliminating all of the viruses that spread by sending electronic mail. Thus, it would be beneficial to combat computer viruses that replicate via e-mail messages.
In one embodiment, the invention provides a method to detect a computer virus. The method includes identifying one or more electronic mail addresses and examining an outgoing electronic mail message to determine if the identified electronic mail addresses corresponds to a recipient of the electronic mail message. In addition, the method may include generating an alert if all or a specified number of the identified electronic mail addresses corresponds to recipients of the outgoing electronic mail message. Alternatively, the method may be embodied in instructions stored on a program storage device that is readable by a programmable control device. In another embodiment, the programmable storage device which includes instructions of the method may be included in a computer system having an electronic mail application.